5 ms·

The fix implements a basic state machine to ensure protocol state transitions are sane. Prior to this, attacker-supplied data was used in calculating the offset

by wepple 8y ago

The fix implements a basic state machine to ensure protocol state transitions are sane. Prior to this, attacker-supplied data was used in calculating the offset inside an array of callbacks. So you could just tell the server to call into the “auth success” handler.

westmeal 8y ago
How on earth did this get past the developer dear god
- zaroth 8y ago
  This is the state of libssh. As if it wasn’t already, “many eyeballs theory” is turning over in it’s grave. Contrast this level of insanity to a proposed standard of “developers should be liable for the damage caused by their negligent code”. Just, wow.
  - Sir_Cmpwn 8y ago
    libssh is pretty niche. This isn't openssh.
    - kevingadd 8y ago
      So "niche" it was used by github, albeit in a configuration that protected them from this
    - akvadrako 8y ago
      libssh is used because openssh isn't suited to be used as a library. So it's one of the most popular ways to automate the most popular remote shell protocol. It's not really niche - I'd say it's an average popularity library and likely used by a bunch of internal projects.
      - duskwuff 8y ago
        The libssh client code is used pretty commonly for that sort of thing. The libssh server code, on the other hand, is pretty niche.
  - throwaway2048 8y ago
    Except for github, its unlikely you use any software that uses libssh. Just because it has that name dosen't make it some kind of official SSH library that tons of software uses.
    - lostmsu 8y ago
      What does git use?
      - dijit 8y ago
        OpenSSH.
        raimue 8y ago
        Actually, just whatever 'ssh' binary is installed. That is not necessarily OpenSSH, but it is the most common choice.
      - deleted 8y ago
        [deleted]
  - heavenlyblue 8y ago
    >> developers should be liable for the damage caused by their negligent code To be fair, at this point I would rather see developers not writing code; rather than writing buggy one. I had a friend on FB who's just completed a security course and wrote a password generator in Go. The random was seeded from a current date in nanoseconds. The issue is that while no one will probably ever reverse his passwords, but the guy open-sourced his script. How many people will be influenced by that piece of code? Lawyers have that: if you can't be liable - you're not a lawyer. GTFO.
    - lrvick 8y ago
      I found that same exact issue in Terraform Go code where it generates passwords for AWS IAM users: https://www.cvedetails.com/cve/CVE-2018-9057/ https://www.cvedetails.com/cve/CVE-2018-9057/ We need to find out who is teaching this stupidity and make them stop.
- informatimago 8y ago
  Easy: it's implemented in C. While the brain cells of the C programmers are busy handling errors, managing memory, and avoiding buffer overflow, they forget about sound software engineering rules and proper design. While the code of libssh looks cleaner than eg. FreeBSD, there are still quite a number of functions that are bigger than a screen height.
  - vbezhenar 8y ago
    I don't see how different language would protect you from this kind of vulnerability. Array of callbacks looks identical everywhere. Rust or Java would protect from out-of-bounds memory access (and that is a very good thing in that case), but this particular bug would be present.
    - XCabbage 8y ago
      You're assuming there would even be an array of callbacks if the code had been written in a different language, rather than the other language offering some nicer abstraction that eliminated the array. Having not seen the code, I can't be sure of this, but I know that, for instance, I rarely need to write array index arithmetic in the languages I usually work with (Python, JavaScript) whereas on the occasions I've dabbled with C such arithmetic came up constantly. If I introduced a nasty bug in some C code due to an array arithmetic error, arguing "Python wouldn't be any better because it doesn't do anything to make manually writing array index manipulations easier" would be missing the point.
      - vbezhenar 8y ago
        Array of callbacks (or long switch which is essentially the same) is a standard method to implement state machine.
        kaoD 8y ago
        And that's why you should use a thoroughly tested implementation instead of implementing a bug-ridden ad-hoc square wheel. "Whoopsies, I forgot to ban some state transitions" won't happen if all you're writing is a state machine spec, and not a state machine spec and its ad-hoc implementation. Don't roll your own crypto? Extend it to "don't roll your own low-level constructs".

by wepple 8y ago

westmeal 8y ago

How on earth did this get past the developer dear god

zaroth 8y ago
This is the state of libssh. As if it wasn’t already, “many eyeballs theory” is turning over in it’s grave. Contrast this level of insanity to a proposed standard of “developers should be liable for the damage caused by their negligent code”. Just, wow.
- Sir_Cmpwn 8y ago
  libssh is pretty niche. This isn't openssh.
  - kevingadd 8y ago
    So "niche" it was used by github, albeit in a configuration that protected them from this
  - akvadrako 8y ago
    libssh is used because openssh isn't suited to be used as a library. So it's one of the most popular ways to automate the most popular remote shell protocol. It's not really niche - I'd say it's an average popularity library and likely used by a bunch of internal projects.
    - duskwuff 8y ago
      The libssh client code is used pretty commonly for that sort of thing. The libssh server code, on the other hand, is pretty niche.
- throwaway2048 8y ago
  Except for github, its unlikely you use any software that uses libssh. Just because it has that name dosen't make it some kind of official SSH library that tons of software uses.
  - lostmsu 8y ago
    What does git use?
    - dijit 8y ago
      OpenSSH.
      - raimue 8y ago
        Actually, just whatever 'ssh' binary is installed. That is not necessarily OpenSSH, but it is the most common choice.
    - deleted 8y ago
      [deleted]
- heavenlyblue 8y ago
  >> developers should be liable for the damage caused by their negligent code To be fair, at this point I would rather see developers not writing code; rather than writing buggy one. I had a friend on FB who's just completed a security course and wrote a password generator in Go. The random was seeded from a current date in nanoseconds. The issue is that while no one will probably ever reverse his passwords, but the guy open-sourced his script. How many people will be influenced by that piece of code? Lawyers have that: if you can't be liable - you're not a lawyer. GTFO.
  - lrvick 8y ago
    I found that same exact issue in Terraform Go code where it generates passwords for AWS IAM users: https://www.cvedetails.com/cve/CVE-2018-9057/ https://www.cvedetails.com/cve/CVE-2018-9057/ We need to find out who is teaching this stupidity and make them stop.
informatimago 8y ago
Easy: it's implemented in C. While the brain cells of the C programmers are busy handling errors, managing memory, and avoiding buffer overflow, they forget about sound software engineering rules and proper design. While the code of libssh looks cleaner than eg. FreeBSD, there are still quite a number of functions that are bigger than a screen height.
- vbezhenar 8y ago
  I don't see how different language would protect you from this kind of vulnerability. Array of callbacks looks identical everywhere. Rust or Java would protect from out-of-bounds memory access (and that is a very good thing in that case), but this particular bug would be present.
  - XCabbage 8y ago
    You're assuming there would even be an array of callbacks if the code had been written in a different language, rather than the other language offering some nicer abstraction that eliminated the array. Having not seen the code, I can't be sure of this, but I know that, for instance, I rarely need to write array index arithmetic in the languages I usually work with (Python, JavaScript) whereas on the occasions I've dabbled with C such arithmetic came up constantly. If I introduced a nasty bug in some C code due to an array arithmetic error, arguing "Python wouldn't be any better because it doesn't do anything to make manually writing array index manipulations easier" would be missing the point.
    - vbezhenar 8y ago
      Array of callbacks (or long switch which is essentially the same) is a standard method to implement state machine.
      - kaoD 8y ago
        And that's why you should use a thoroughly tested implementation instead of implementing a bug-ridden ad-hoc square wheel. "Whoopsies, I forgot to ban some state transitions" won't happen if all you're writing is a state machine spec, and not a state machine spec and its ad-hoc implementation. Don't roll your own crypto? Extend it to "don't roll your own low-level constructs".